Last active
September 17, 2025 13:30
-
-
Save sdesalas/19e77059113554a45190765b78eb637d to your computer and use it in GitHub Desktop.
Ways to get security rules from Kibana
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Get all indices sorted by size | |
| GET /_cat/indices?v=true&s=dataset.size | |
| # Get all kibana indices sorted by size | |
| GET /_cat/indices/.kibana*?v=true&s=dataset.size | |
| # Get system table data for security solution | |
| GET .kibana_security_solution_9.2.0_001/_search | |
| # This one contains rules | |
| GET .kibana_alerting_cases/_search | |
| # This one contains alerts | |
| GET .internal.alerts-security.alerts-default-000001/_search | |
| # This one gets rules with direct API call (/kbn/api/...) | |
| GET kbn:/api/detection_engine/rules/_find | |
| # This one also gets rules with direct API call | |
| GET kbn:/api/alerting/rules/_find |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment